Keyless Attestation Support #835

spiffcs · 2022-02-17T16:00:14Z

What would you like to be added:
Support for Sigstore's "Keyless Workflow" in the syft attest command

With the addition of #510 in #785 syft is now able to produce a signed attestation with the generated SBOM as the predicate.

We want to see ephemeral keys and certificates (automatically signed by fulcio) supported where signatures are stored in the rekor transparency log.

Users will no longer have to pass an on-disk key and can use attest in the same way they sign other entities with cosign today.

Why is this needed:
Supporting the keyless workflow means Syft users can generate signed SBOM attestations without needing to manage their own keys. Additionally, the keyless workflow provides a stronger way to bind identities (from OIDC) to signatures in a highly discoverable manner, which is valuable to downstream SBOM consumers looking to trust where the SBOM came from.

Additional context:
See #510 for greater attestation roadmap.

The text was updated successfully, but these errors were encountered:

developer-guy · 2022-03-21T12:28:58Z

we (w/@Dentrax) would like to give a hand to this, please let us know if there is anything we can help with 🙋🏻‍♂️

spiffcs · 2022-03-21T15:45:21Z

@developer-guy That would be awesome. I'm working on an initial pass today - Are you and @Dentrax free tomorrow so I can get feedback on what you want to see included and what a "complete" keyless experience looks like here?

spiffcs · 2022-03-22T16:29:14Z

@developer-guy here is a branch with the rough edges working.

https://github.com/anchore/syft/tree/835-keyless-attestation-upgrade

I'm currently trying to get a localized integration test stood up so we can exercise all the different flows.

go run main.go attest <YOUR_IMAGE> > attestation.json should let you give it a spin.

spiffcs · 2022-05-07T15:58:59Z

The initial changes for this have been merged in #910. I'm going to leave this issue open as there are probably a few improvements and expansions to be made past the initial support of keyless.

jauderho · 2022-05-09T23:36:31Z

Right now I use

          cosign sign docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }}
          syft docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }} -o json > docker_sbom.json
          cosign attest --predicate docker_sbom.json docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }}
          cosign verify-attestation docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }}

Just to confirm that with this change, I'll be to do the following instead?

          cosign sign docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }}
          syft attest -o syft-json docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }} 
          cosign verify-attestation docker.io/${{ env.REPOSITORY }}@${{ steps.push-step.outputs.digest }}

COSIGN_EXPERIMENTAL=1 is set elsewhere.

spiffcs · 2022-05-10T20:02:01Z

@jauderho! That's correct. I just ran this on my local environment and verified the workflow for an image I use. If you have any issues or suggestions for improving this based on your use case let me know on this issue and we can get the ball rolling there.

Switch to keyless syft attestation. See anchore/syft#835 (comment)

jauderho · 2022-05-17T23:56:22Z

Hmm, I'm getting an error when I try this. See https://github.com/jauderho/dockerfiles/runs/6480238360?check_suite_focus=true

open cosign.key: no such file or directory

Here's the full output if you are not able to get to the first link: https://gist.github.com/jauderho/e9b7293bbaa3f2e4c5dde09607b586aa

Not sure why it's trying to open a key if this is supposed to be keyless.

Here's the change that I made in my workflow: jauderho/dockerfiles@9f37033

On a possibly related note, I have been seeing some weirdness with GHCR recently where I am unable to successfully push a different image. Not sure if that is the cause.

spiffcs · 2022-05-26T19:11:37Z

@jauderho I'll take a look and see if I can replicate the issue you're seeing. When doing the default flow you should not see a cosign.key.

Which version of syft are you using?

jauderho · 2022-05-26T19:45:51Z

@spiffcs

Looking at the output from that run, it appears to be v0.44.1. I'd further point out that it seems to be working fine with Docker Hub, just not GHCR.

I'll try a run with GHCR commented out to see what happens.

Run anchore/sbom-action/download-syft@bb716408e75840bbb01e839347cd213767269d4a
  with:
  env:
    BUILD_VERSION: v1.0.0
    DOCKER_CLI_EXPERIMENTAL: enabled
    REPOSITORY: ***/age
/usr/bin/sh /home/runner/work/_temp/4c3c65d1-8526-4a9b-883f-f2cfde297e79 -d -b /home/runner/work/_temp/4c3c65d1-8526-4a9b-883f-f2cfde297e79_syft v0.44.1
[debug] checking github for release tag='v0.44.1' 
[debug] http_download(url=https://github.com/anchore/syft/releases/v0.44.1) 
[info] fetching release script for tag='v0.44.1' 
[debug] http_download(url=https://raw.githubusercontent.com/anchore/syft/v0.44.1/install.sh) 
[debug] checking github for release tag='v0.44.1' 
[debug] http_download(url=https://github.com/anchore/syft/releases/v0.44.1) 
[info] using release tag='v0.44.1' version='0.44.1' os='linux' arch='amd64' 
[debug] downloading files into /tmp/tmp.OmdePTK3eF 
[debug] http_download(url=https://github.com/anchore/syft/releases/download/v0.44.1/syft_0.44.1_checksums.txt) 
[debug] http_download(url=https://github.com/anchore/syft/releases/download/v0.44.1/syft_0.44.1_linux_amd64.tar.gz) 
[info] installed /home/runner/work/_temp/4c3c65d1-8526-4a9b-883f-f2cfde297e79_syft/syft

jauderho · 2022-05-26T21:34:52Z

Looks like if I comment out GHCR, my run with just Docker Hub now fails. Feels like there might be an off by one issue somewhere as I was previously able to push the signature successfully to Docker Hub.

Run cosign sign docker.io/***/age@sha256:3b3cc8b88aa2476fea72311d1113dc311b0c31ee87d2c4634167779d76ef7b5b
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
tlog entry created with index: 2443309
Pushing signature to: index.docker.io/***/age
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
tlog entry created with index: 2443311
Pushing signature to: ghcr.io/***/age
open cosign.key: no such file or directory
Error: Process completed with exit code 1.

Compare this to the prior run

Run cosign sign docker.io/***/age@sha256:39a48b7b86fb16babf0475f7a8847f4e985be5502a252032aaf716b97a6fc092
  cosign sign docker.io/***/age@sha256:39a48b7b86fb16babf0475f7a8847f4e985be5502a252032aaf716b97a6fc092
  cosign sign ghcr.io/***/age@sha256:39a48b7b86fb16babf0475f7a8847f4e985be5502a252032aaf716b97a6fc092
  syft attest -o syft-json docker.io/***/age@sha256:39a48b7b86fb16babf0475f7a8847f4e985be5502a252032aaf716b97a6fc092
  syft attest -o syft-json ghcr.io/***/age@sha256:39a48b7b86fb16babf0475f7a8847f4e985be5502a252032aaf716b97a6fc092
  shell: /usr/bin/bash -e {0}
  env:
    BUILD_VERSION: v1.0.0
    DOCKER_CLI_EXPERIMENTAL: enabled
    REPOSITORY: ***/age
    COSIGN_EXPERIMENTAL: 1
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
tlog entry created with index: 2378066
Pushing signature to: index.docker.io/***/age
Generating ephemeral keys...
Retrieving signed certificate...
Successfully verified SCT...
tlog entry created with index: 2378067
Pushing signature to: ghcr.io/***/age
open cosign.key: no such file or directory
Error: Process completed with exit code 1.

spiffcs · 2022-05-31T13:30:44Z

Definitely a bug with GHCR - I'm going to close this issue since we confirmed attestation support is working, but open a new bug specific to GHCR and tag you in it - does that sound good?

jauderho · 2022-05-31T15:48:20Z

@spiffcs We can follow up on the other thread that you created but to be clear this is not a GHCR only bug IMO.

--

Reposting from the other thread.

Also, if you look at my last comment, it appears *NOT* to be a GHCR only bug and more of a # of registries targeted bug. I reconfigured my workflow to *only* use Docker Hub and it still fails (when Docker Hub is the only registry defined).

spiffcs · 2022-05-31T15:50:15Z

Thanks for pointing that out! Sorry for missing that detail originally.

jauderho · 2022-08-08T19:26:09Z

@spiffcs Just checking in to see if there has been any new developments with addressing this?

spiffcs added the enhancement New feature or request label Feb 17, 2022

spiffcs self-assigned this Feb 17, 2022

luhring mentioned this issue Mar 21, 2022

create an SBOM attestations using syft and attach them to container image using cosign goreleaser/goreleaser#2997

Closed

2 tasks

spiffcs added the WIP work in progress / do not merge label Apr 7, 2022

spiffcs removed the WIP work in progress / do not merge label May 7, 2022

jauderho added a commit to jauderho/dockerfiles that referenced this issue May 17, 2022

Update age.yml

9f37033

Switch to keyless syft attestation. See anchore/syft#835 (comment)

spiffcs closed this as completed May 31, 2022

spiffcs mentioned this issue May 31, 2022

Attestation Fails using GHCR as upstream image registry #1020

Open

developer-guy mentioned this issue Jun 13, 2022

generate SBOM both SPDX and Cyclone DX formats based for container images and attach em by using cosign attach containerd/nerdctl#669

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keyless Attestation Support #835

Keyless Attestation Support #835

spiffcs commented Feb 17, 2022 •

edited by luhring

Loading

developer-guy commented Mar 21, 2022

spiffcs commented Mar 21, 2022

spiffcs commented Mar 22, 2022 •

edited

Loading

spiffcs commented May 7, 2022 •

edited

Loading

jauderho commented May 9, 2022

spiffcs commented May 10, 2022

jauderho commented May 17, 2022

spiffcs commented May 26, 2022 •

edited by wagoodman

Loading

jauderho commented May 26, 2022 •

edited

Loading

jauderho commented May 26, 2022

spiffcs commented May 31, 2022

jauderho commented May 31, 2022

spiffcs commented May 31, 2022

jauderho commented Aug 8, 2022

Keyless Attestation Support #835

Keyless Attestation Support #835

Comments

spiffcs commented Feb 17, 2022 • edited by luhring Loading

developer-guy commented Mar 21, 2022

spiffcs commented Mar 21, 2022

spiffcs commented Mar 22, 2022 • edited Loading

spiffcs commented May 7, 2022 • edited Loading

jauderho commented May 9, 2022

spiffcs commented May 10, 2022

jauderho commented May 17, 2022

spiffcs commented May 26, 2022 • edited by wagoodman Loading

jauderho commented May 26, 2022 • edited Loading

jauderho commented May 26, 2022

spiffcs commented May 31, 2022

jauderho commented May 31, 2022

spiffcs commented May 31, 2022

jauderho commented Aug 8, 2022

spiffcs commented Feb 17, 2022 •

edited by luhring

Loading

spiffcs commented Mar 22, 2022 •

edited

Loading

spiffcs commented May 7, 2022 •

edited

Loading

spiffcs commented May 26, 2022 •

edited by wagoodman

Loading

jauderho commented May 26, 2022 •

edited

Loading